How to Decode a JWT Token

Have you ever looked at a string of random characters like eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... and wondered what it actually means? That's a JSON Web Token (JWT).

JWTs are the backbone of modern web authentication. In this guide, we'll break down exactly what they are and how to decode them.

🧩 The Structure of a JWT

A JWT isn't encrypted—it's just encoded. It consists of three parts, separated by dots (.):

1. Header: Contains metadata about the token (like the algorithm used).
2. Payload: The actual data (claims) being transmitted (like User ID or role).
3. Signature: A cryptographic hash used to verify the token hasn't been tampered with.

// Example Header
{
  "alg": "HS256",
  "typ": "JWT"
}

🛠️ How to Decode It

Because the Header and Payload are just Base64Url encoded, you can easily decode them using built-in browser tools or our dedicated decoder.

[!WARNING] Never put sensitive information (like passwords) in a JWT payload, because anyone can decode it! The signature only prevents tampering, not reading.

Step-by-Step Decoding

If you wanted to do this manually in Javascript, you could write:

const token = "your.jwt.token";
const base64Url = token.split('.')[1]; // Get the payload
const base64 = base64Url.replace(/-/g, '+').replace(/_/g, '/');
const jsonPayload = decodeURIComponent(atob(base64));

console.log(JSON.parse(jsonPayload));

Or... you could just use a tool that does it instantly! 👇